fix(container): copy AI workspace manifest

[andrei-hasna]

Summary

• copy the ai workspace manifest into the Docker dependency stage before bun install --frozen-lockfile
• add a regression derived from the root package.json workspace list

Evidence

• red gate before the Dockerfile fix: 0 pass, 1 fail, missing workspace manifest copy
• focused regression: 1 pass, 0 fail
• existing Docker-context lane: 6 pass, 0 fail
• root and AI typechecks: exit 0
• no-cloud lane: 38 pass, 1 skip, 0 fail
• server build: exit 0
• staged secret scan: findingCount: 0, truncated: false

Scope

Fixes the Docker-context P1 reported on #271 and tracked by OPE8-00073 (dcb420ce-21e6-4c0b-9dad-8f0a15950d12) under OPE8-00072 (2b6455c7-5c8f-4afd-815f-9bd68850c8f0).

Do not merge until the fixed reviewer codewith-sol-reviewer posts focused remediation-cycle-one GO on the exact head. No AWS, image, provider, deploy, publish, or install mutation is part of this pull request.

[andrei-hasna]

[REVIEW] GO — #272 @ 570eaa9 — lens: Docker-context defect + direct regressions, reviewer codewith-sol-reviewer (1 of 1)

P0: None.

P1: None. The prior blocker is fixed: the Docker dependency stage now copies both root workspace manifests (dashboard/package.json and ai/package.json) before RUN bun install --frozen-lockfile --ignore-scripts.

Evidence inspected:

• Immutable candidate: head 570eaa9733e74212f96baccaa914c22d804c933f, tree 08469e0fe747fddc95219bf2ca154d83a40dc5c6, current base 34751c1061a1947a6744a6258edc3a35e2c44e5f, merge tree aa96f8f729663dddcf366c82a37e976ee1bcfe9b. The current-base merge result changes only Dockerfile and src/container-dependency-context.test.ts; those changed paths match the reviewed head exactly.
• The regression derives required manifests from the root package.json workspaces, proves each manifest exists, and requires its Docker COPY before the frozen install. Fresh affected-lane rerun: 7 pass, 0 fail.
• Complete local captures: focused regression 1 pass / 0 fail; existing Docker-context suite 6 pass / 0 fail; root and AI typechecks rc=0; no-cloud guards 38 pass / 1 skip / 0 fail; server build rc=0; fresh root frozen install 644 packages installed; AI build Bundled 9 modules; AI package exports 2 pass / 0 fail; diff check rc=0.
• Staged secret scan at the two-file candidate: filesScanned: 2, filesSkipped: 0, findingCount: 0, truncated: false, rc=0.
• Exact-head Docker verification already recorded on this artifact: dependency-stage build rc=0 and full Docker build rc=0.
• Hosted CI run 31435587912 completed success at the exact head. The dashboard job passed; the test job passed install, AI install, both typechecks, no-cloud guards, full tests, AI tests, root build, and AI build.

The separate workflow verifier-infrastructure failure is not a defect in this product candidate and is excluded from this focused verdict.

Remaining reachable in-scope P0/P1: none.

P2/P3: None recorded in the focused scope.

[andrei-hasna]

[REVIEW] GO — #272 @ 570eaa9 merged with 34751c1 → aa96f8f729663dddcf366c82a37e976ee1bcfe9b — lens: Docker-context merge-result verification, reviewer codewith-sol-reviewer (1 of 1)

Focused verification only; this does not reopen or broaden the completed remediation review.

Identity binding:

• current base commit: 34751c1061a1947a6744a6258edc3a35e2c44e5f
• reviewed head commit: 570eaa9733e74212f96baccaa914c22d804c933f
• reviewed head tree: 08469e0fe747fddc95219bf2ca154d83a40dc5c6
• computed current-base merge-result tree: aa96f8f729663dddcf366c82a37e976ee1bcfe9b

The merge-result tree differs from the reviewed-head tree because the current base contains unrelated landed work. The candidate-specific base-to-merge-result diff remains exactly Dockerfile plus src/container-dependency-context.test.ts. Comparing the reviewed head to the merge result returns no difference for either reviewed path (rc=0). The only root-manifest interaction is the base version change from 0.15.25 to 0.15.26; the dashboard and ai workspace set consumed by the source-derived regression is unchanged.

The named Docker dependency-context fix and its direct regression therefore remain covered by the prior GO verdict at this exact merge result.

Remaining reachable in-scope P0/P1: none.